Is CVE-2026-41011 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41011 being exploited in the wild.

How severe is CVE-2026-41011?

High severity, with a CVSS score of 8.2, published 4 June 2026.

Which products and versions are affected?

Cloud Foundry Foundation BOSH versions prior to v282.1.12.

Is there a fix for CVE-2026-41011?

A patch was published on 2026-06-02: Fixed in BOSH v282.1.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41011 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-41011?

Check whether you run Cloud Foundry Foundation BOSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41011: Cloud Foundry BOSH command injection in PackagePersister

CVE-2026-41011 · Severity: high · CVSS 8.2 · Published 2026-06-04

Cloud Foundry BOSH, a tool used for deploying and managing large-scale cloud applications, contains a security flaw in how it processes uploaded software packages. An attacker with administrative privileges could upload a specially crafted package file that executes unauthorized commands on the BOSH Director server. This could lead to a full system takeover, allowing the attacker to disrupt operations or access sensitive data across the entire cloud environment.

Technologies: Cloud Foundry Foundation BOSH. Vendors: Cloud Foundry Foundation.

Quick answers

Is CVE-2026-41011 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41011 being exploited in the wild.
How severe is CVE-2026-41011?: High severity, with a CVSS score of 8.2, published 4 June 2026.
Which products and versions are affected?: Cloud Foundry Foundation BOSH versions prior to v282.1.12.
Is there a fix for CVE-2026-41011?: A patch was published on 2026-06-02: Fixed in BOSH v282.1.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41011 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-41011?: Check whether you run Cloud Foundry Foundation BOSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the BOSH PackagePersister.validate_tgz method. The component constructs a shell command using the 'name' field from the release.MF file found within an uploaded tarball without applying proper shell escaping. This string is passed to Bosh::Common::Exec.sh, which executes via /bin/sh -c. While validation logic exists to restrict package names, the shell-out occurs in the save_package_source_blob path before the validation is triggered. An attacker with 'bosh.releases.upload' or 'bosh.admin' privileges can exploit this by crafting a package name containing shell metacharacters (e.g., semicolons or backticks) to achieve arbitrary code execution on the BOSH Director. The issue is fixed in BOSH v282.1.12.

Affected products

Cloud Foundry Foundation BOSH versions prior to v282.1.12

Timeline

2026-06-02: advisory: Initial advisory published by Cloud Foundry Foundation
2026-06-04: disclosed: CVE published to NVD
2026-06-02: patched: Fixed in BOSH v282.1.12

References

https://www.cloudfoundry.org/blog/cve-2026-41011-package-name-command-injection/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.